Tax and Accounting Firms: Writing the Information Security Plan the FTC Safeguards Rule Requires

Why a tax firm falls under this rule

Most owners of small accounting and tax practices think of the Federal Trade Commission as someone else's regulator. For this purpose it is yours. The Gramm-Leach-Bliley Act (GLBA) directs federal agencies to set safeguards for customer financial information, and the FTC's version, the Safeguards Rule in Title 16 of the Code of Federal Regulations, Part 314, covers financial institutions that no banking regulator supervises. The rule's definition of a financial institution includes activities such as tax preparation and related services, so a firm that prepares returns, keeps client financial records and handles identity and bank details is inside it.

The IRS says the same thing from its side. Its guidance for tax professionals states that the Safeguards Rule requires a written information security plan, and that a missing plan can lead to an FTC enforcement action. In short, a written plan is not a best practice for this industry. It is a legal requirement, and it is the first document a regulator or an insurer asks to see.

What the rule requires, in plain terms

The current rule has been in force in stages since 2021, with the last major provisions taking effect in 2023 and the FTC notification duty in 2024. Section 314.4 lists the elements of the information security program. In plain words:

• Name a Qualified Individual to run the program. It can be an employee or an outside provider, but the firm stays responsible and must supervise.
• Write a risk assessment that identifies the internal and external risks to client information and says how each is judged and handled. It is revisited as the firm changes.
• Know where client information lives. The rule requires an inventory of the data, the devices and the systems that touch it.
• Control access so that staff reach only what their job needs, and review that regularly.
• Encrypt client information in transit over external networks and at rest.
• Use multi-factor authentication for anyone accessing any information system, with narrow exceptions approved in writing by the Qualified Individual.
• Log the activity of authorized users and watch for unauthorized access.
• Dispose of client information securely, generally no later than two years after it was last used to serve the client, unless a business or legal need requires keeping it.
• Manage change, so that a new system or configuration is reviewed before it holds client data.
• Test the safeguards: continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months.
• Train staff, and keep the Qualified Individual and security staff current.
• Oversee service providers: choose them with care, require safeguards in the contract and check on them.
• Keep a written incident response plan with roles, steps and a post-incident review.
• Have the Qualified Individual report in writing to the owners or board at least once a year.

Section 314.6 exempts firms that hold information on fewer than 5,000 consumers from several items: the written risk assessment, the continuous monitoring or testing, the written incident response plan and the annual report. The exemption is narrower than it sounds. The core safeguards, such as access control, encryption, multi-factor authentication and training, still apply. And an insurer or a client will ask for the written versions anyway, so most small firms write them.

What the IRS publications give you

IRS Publication 5708, Creating a Written Information Security Plan for Your Tax and Accounting Practice, is a template that walks through the plan's sections and includes sample wording. IRS Publication 4557, Safeguarding Taxpayer Data, is a shorter guide and checklist. Both are free on irs.gov and both are sensible starting points. They also lean on what the IRS and the Security Summit call the Security Six: current security software, firewalls, multi-factor authentication, backups, drive encryption and a virtual private network for remote work.

A template has one weakness. It makes a plan easy to write and no easier to follow. The usual failure is a tidy document that says every laptop is encrypted and every account uses multi-factor authentication, while the real firm has three laptops that are not and a shared login for the scanner. When a breach happens, the gap between the plan and the practice is what turns an incident into a violation.

Writing a plan you can run

A plan that works is short enough that the Qualified Individual reads it every quarter. We suggest building it in this order.

• Start with the inventory. List every system that touches client data: the tax software, the document portal, email, the scanner, laptops, phones, cloud storage and any offshore or outsourced preparer. You cannot write the risk assessment before you know what is in scope.
• Write the risk assessment as a table: asset, threat, current control, gap, owner, date. Phishing, stolen credentials, lost devices, a compromised outsourced provider and ransomware cover most of the realistic list for a firm of this size.
• Turn each gap into a task with a name and a date, and turn each control into something you can check: a setting, a report or a screenshot kept in a folder.
• Write the incident plan on one or two pages: who decides, who calls the insurer, who notifies the IRS stakeholder liaison and state agencies, who contacts clients, and where the offline copy of the contact list lives.
• Add the vendor list with what each vendor holds and the contract clause that covers safeguards.

Breaches: who to tell, and how fast

Three clocks can run at once. The FTC Safeguards Rule requires notice to the FTC of a notification event, defined as the unauthorized acquisition of unencrypted customer information, when it involves at least 500 consumers, as soon as possible and no later than 30 days after discovery. The IRS asks tax professionals to report a data theft to their IRS stakeholder liaison without delay, and to contact their state tax agency and the state attorney general. And state breach laws, such as Florida's, set their own consumer-notice deadlines. Our article on the Florida Information Protection Act covers that one. Know the contacts in advance, because during an incident nobody has time to look them up.

Common gaps we see

• Multi-factor authentication on email but not on the tax software, the portal or the remote desktop.
• Client documents sitting in email attachments and download folders long after the return was filed.
• A shared account for the scanner or a seasonal worker, with no log of who did what.
• Backups that exist but have never been restored, and that ransomware could reach.
• No evidence of the annual review, so the written plan cannot be shown to be alive.

If you want a plan written against your real systems, or a gap check before the next filing season, start with our Cybersecurity service. Our team can act as the Qualified Individual under your supervision, or work alongside the person you name.

Sources

• 16 CFR Part 314, Standards for Safeguarding Customer Information (eCFR)
• FTC Safeguards Rule: What Your Business Needs to Know (Federal Trade Commission)
• IRS Publication 5708, Creating a Written Information Security Plan for Your Tax and Accounting Practice
• IRS Publication 4557, Safeguarding Taxpayer Data
• Protect Your Clients; Protect Yourself (Internal Revenue Service)

This article is general information, not legal advice. Confirm your obligations under the Safeguards Rule, the IRS requirements and state law with your counsel. Last reviewed November 9, 2026.

Keep reading

Next · SecurityProtecting Donor Data on a Small Nonprofit Budget: Ten Controls in OrderDonor lists hold names, addresses, giving history and sometimes payment details, and small nonprofits rarely have a security team. This article ranks the controls that remove the most risk first, so a limited budget goes where it counts.8 min read

• SAQ A or SAQ A-EP: Which Questionnaire Fits Your Donation or Checkout Page?8 min
• SEC Regulation S-P Amendments: A Practical Checklist for Investment Advisers and Broker-Dealers7 min